aeowin Privacy Policy —
Your Data, Your Rights

Introduction and Scope

This Privacy Policy ("Policy") describes how aeowin ("aeowin," "we," "us," or "our") — the operator of the online casino and sports betting platform accessible at aeowin.co — collects, processes, stores, uses, and discloses personal information relating to individuals ("you," "your," or "data subject") who access or use the aeowin Platform.

This Policy applies to all personal information collected through the aeowin website and platform, including but not limited to: the account registration process, the KYC identity verification process, deposit and withdrawal transactions, gameplay activity, customer support interactions, and marketing communications.

This Policy is issued in compliance with the Data Privacy Act of 2012 (Republic Act No. 10173), its Implementing Rules and Regulations, and the issuances of the National Privacy Commission of the Philippines. Where applicable, this Policy also reflects aeowin's compliance obligations under PAGCOR's data governance guidelines for licensed online gaming operators.

Data Controller

For purposes of the Data Privacy Act of 2012, aeowin acts as the Personal Information Controller (PIC) with respect to the personal data of its registered players and site visitors. As the PIC, aeowin determines the purposes and means of processing your personal information in connection with the operation of the aeowin Platform.

aeowin has designated a Data Protection Officer (DPO) responsible for overseeing the implementation of this Policy and ensuring compliance with applicable data privacy laws. Queries and requests relating to data privacy may be directed to the DPO as described in Section 17 of this Policy.

Certain third-party service providers who process personal data on behalf of aeowin — including KYC verification providers, payment processors, and game studios — act as Personal Information Processors (PIPs) and process data solely on aeowin's documented instructions under binding data processing agreements.

Personal Data We Collect

aeowin collects the following categories of personal data, depending on how you interact with the Platform:

3.1 Registration and Identity Data

• Full legal name (as it appears on government-issued ID)
• Date of birth
• Philippine residential address
• Philippine mobile number
• Email address
• Username / account name chosen at registration

3.2 KYC and Verification Data

• Government-issued ID document (PhilSys National ID, UMID, passport, driver's license, PRC ID, Voter's ID, SSS/GSIS ID, or other accepted Philippine identification)
• Selfie photograph submitted during identity verification
• Source of funds declarations where applicable
• Enhanced due diligence documents where required for high-volume accounts

3.3 Financial Data

• GCash account number (masked for display; full number stored encrypted)
• Maya / PayMaya account details
• Bank account details for BPI, BDO, or Metrobank transfers (account holder name and account number)
• Deposit and withdrawal transaction records, including timestamps and amounts in PHP

3.4 Gaming Activity Data

• Game session records including titles played, bet amounts, and outcomes
• Sports betting history including markets wagered, odds, and results
• Bonus and promotion participation records
• VIP program tier history and cashback accrual records

3.5 Technical and Device Data

• IP address at time of registration and each login
• Device type, operating system, and browser type
• Cookie identifiers and session tokens
• Platform usage logs and interaction timestamps

3.6 Communications Data

• Customer support chat transcripts and email correspondence
• Records of marketing communication preferences and opt-in/opt-out history
• Feedback and survey responses where voluntarily submitted

How We Collect Personal Data

aeowin collects personal data through the following channels:

• Directly from you: when you register an account, complete the KYC verification process, make a deposit or withdrawal, contact customer support, respond to a survey, or opt in to a promotion.
• Automatically from your device: when you access the aeowin Platform, technical data (IP address, device identifiers, browser type, cookies) is automatically collected through the Platform's standard logging and analytics infrastructure.
• From third-party verification providers: when aeowin's KYC and AML service providers validate your identity documents and perform sanctions screening, they may provide aeowin with the results of those checks, including match scores and risk flags.
• From payment processors: when you initiate a GCash, Maya, or bank transfer transaction, the relevant payment processor confirms the transaction status and associated account details to aeowin for wallet crediting or debit purposes.

Purpose and Legal Basis for Processing

The table below sets out the primary purposes for which aeowin processes your personal data and the corresponding legal basis under the Data Privacy Act of 2012.

Sharing and Disclosure of Personal Data

aeowin does not sell, rent, or trade your personal data to any third party. Personal data is shared only in the following circumstances and only to the extent necessary for each specific purpose:

6.1 Service Providers and Processors

aeowin engages the following categories of third-party service providers who process personal data on our behalf under binding data processing agreements:

• KYC and identity verification providers — to validate government-issued ID documents and perform AML sanctions screening;
• Payment processors — GCash (Globe Fintech Innovations), Maya (PayMaya Philippines), and Philippine banking partners, to facilitate deposit and withdrawal transactions;
• Game studios and providers — JILI, Pragmatic Play, PG Soft, Evolution Gaming, and other licensed providers whose games are available on the Platform, who receive limited session data necessary for game operation and RTP record-keeping;
• Cloud infrastructure providers — for secure hosting and data storage;
• Analytics providers — using anonymized or aggregated data only, for Platform performance monitoring.

6.2 Regulatory and Legal Disclosure

aeowin is legally required to disclose personal data to the following authorities where required by applicable law:

• The Philippine Amusement and Gaming Corporation (PAGCOR) — for regulatory compliance reporting;
• The Anti-Money Laundering Council (AMLC) — for suspicious transaction reporting obligations under the Anti-Money Laundering Act;
• The National Privacy Commission (NPC) — for data breach notifications and regulatory inquiries;
• Philippine law enforcement authorities — pursuant to valid court orders, search warrants, or other lawful legal process.

6.3 Business Transfers

In the event that aeowin undergoes a merger, acquisition, or sale of all or substantially all of its assets, personal data held by aeowin may be transferred to the acquirer as part of that transaction. In such an event, aeowin will notify affected Players by posting a notice on the Platform and, where practicable, by direct communication to the registered email or mobile number on the Account.

International Data Transfers

Some of aeowin's third-party service providers — particularly game studios and cloud infrastructure providers — may process or store personal data in countries outside of the Philippines. Where personal data is transferred to a jurisdiction other than the Philippines, aeowin ensures that appropriate safeguards are in place to protect that data to the standard required by the Data Privacy Act of 2012.

Such safeguards may include: contractual clauses requiring the recipient to process personal data to Philippine data protection standards; binding corporate rules where the recipient is part of a group with established group-wide privacy standards; or transfers to jurisdictions with comparable data protection frameworks recognized by the National Privacy Commission.

You may request information about the specific safeguards applied to any cross-border transfer of your personal data by contacting aeowin's Data Protection Officer at the contact details provided in Section 17.

Data Retention

aeowin retains personal data for as long as is necessary to fulfil the purposes for which it was collected, and for the additional periods required by applicable Philippine law and regulatory obligations. The following indicative retention periods apply:

• Account and registration data: retained for the duration of your active Account, and for a minimum of 5 years following account closure, in compliance with AML and PAGCOR record-keeping requirements;
• KYC documentation: retained for a minimum of 5 years from the date of the last transaction on the Account, as required by anti-money laundering legislation;
• Financial transaction records: retained for a minimum of 5 years from the date of each transaction;
• Gaming activity records: retained for a minimum of 3 years;
• Customer support records: retained for 2 years from the date of the last interaction;
• Marketing consent records: retained for the duration of the consent plus 2 years to demonstrate compliance.

Where legal proceedings, regulatory investigations, or dispute resolution processes are ongoing at the time a standard retention period would otherwise expire, the relevant records will be retained until the conclusion of those proceedings.

Data that is no longer required for any purpose and for which no legal retention obligation applies is deleted or anonymized in a manner that makes re-identification impossible. Anonymized data may be retained indefinitely for analytical and statistical purposes.

Cookies and Tracking Technologies

The aeowin Platform uses cookies and similar tracking technologies to provide a functional and personalized user experience. A cookie is a small text file placed on your device by the Platform when you access it. The following categories of cookies are used:

• Essential / Strictly Necessary Cookies: Required for the Platform to function. These include session cookies that maintain your login state and security tokens that protect your account. These cookies cannot be disabled without breaking core Platform functionality.
• Preference Cookies: Remember your settings and preferences, such as language selection and game lobby layout preferences, so you don't need to reconfigure them on each visit.
• Analytics Cookies: Collect anonymized data about how Players interact with the Platform — which pages are visited, how long sessions last, and where errors occur. This data is used to improve Platform performance and the Filipino player experience. aeowin uses self-hosted analytics where possible to minimize third-party data exposure.
• Security Cookies: Help aeowin detect and prevent fraudulent login attempts, bot activity, and account security threats by establishing device fingerprinting data associated with your registered Account.

You may manage cookie settings through your browser's privacy controls. Please note that disabling essential cookies will impair Platform functionality and may prevent you from logging in to your aeowin Account. aeowin does not use cookies to serve third-party advertising on the Platform.

Security Measures

aeowin implements a comprehensive set of technical and organizational security measures to protect your personal data against unauthorized access, disclosure, alteration, loss, or destruction. These measures include but are not limited to:

• Encryption in transit: All data transmitted between your device and aeowin's servers is encrypted using 256-bit SSL/TLS protocols. This is confirmed by the padlock indicator in your browser's address bar when accessing aeowin.co.
• Encryption at rest: Sensitive personal data — including KYC documents, identity details, and financial records — is stored in encrypted form on aeowin's servers. Encryption keys are managed separately from the encrypted data.
• Access controls: Access to personal data within aeowin's systems is restricted on a strict need-to-know basis. Personnel are granted access only to the data categories required for their specific job function, and all access is logged and auditable.
• Two-factor authentication: All internal systems containing personal data require multi-factor authentication for staff access. Players are strongly encouraged to enable 2FA on their own aeowin Accounts.
• Regular security assessments: aeowin conducts periodic security reviews and vulnerability assessments of its Platform infrastructure.
• Incident response: aeowin maintains a documented data breach response procedure as described in Section 14 of this Policy.

While aeowin takes all reasonable precautions to protect your data, no method of electronic transmission or storage is 100% secure. In the event of a security incident that materially affects your personal data, aeowin will notify you as described in Section 14.

Minors and the 21+ Age Restriction

Age is verified as part of the mandatory KYC process. aeowin takes the protection of personal data belonging to younger individuals seriously and requires identity verification documents during registration specifically to prevent underage access to the Platform.

If you believe that a person under the age of 21 has registered an aeowin Account, please contact aeowin's support team or Data Protection Officer immediately at the contact details in Section 17.

Marketing Communications

aeowin may send promotional communications — including bonus offers, new game announcements, VIP program updates, and event promotions — to Players who have opted in to receive such communications during account registration or through Account Settings.

You may withdraw your consent to receive marketing communications at any time by:

• Updating your communication preferences in Account Settings → Notifications;
• Clicking the unsubscribe link included in any marketing email from aeowin; or
• Contacting aeowin support via live chat or email with your opt-out request.

Withdrawal of marketing consent does not affect the lawfulness of processing based on consent prior to withdrawal. It does not affect your ability to receive transactional messages (such as deposit confirmations, withdrawal notifications, account security alerts, and responsible gaming notifications), which are sent to all registered Players as an essential part of the Platform service.

Exercising Your Data Subject Rights

To exercise any of the data subject rights described in the rights summary section above, or any other right afforded to you under the Data Privacy Act of 2012, please submit a written request to aeowin's Data Protection Officer using the contact details provided in Section 17.

Your request should include:

• Your full name and registered Account username;
• Your registered Philippine mobile number or email address;
• A clear description of the right you wish to exercise and the specific data concerned;
• A copy of a valid Philippine government-issued ID to verify your identity (required to process access, rectification, and erasure requests).

aeowin will acknowledge receipt of your request within 5 business days and aims to fulfill or respond with a reasoned refusal within 15 business days from the date a complete request is received. Complex requests or requests involving large volumes of data may take longer, in which case aeowin will inform you of the anticipated timeline.

aeowin will not charge a fee for standard data subject requests. Where requests are manifestly unfounded or excessive — particularly where they are repetitive — aeowin reserves the right to charge a reasonable administrative fee or decline to respond, in accordance with RA 10173.

Data Breach Notification

In the event that aeowin experiences a personal data breach — defined as any security incident resulting in unauthorized access to, disclosure of, destruction of, or loss of personal data — aeowin will follow its documented incident response procedure, which includes:

• Containment and assessment of the breach within the shortest practicable time;
• Notification to the National Privacy Commission (NPC) within 72 hours of becoming aware of a breach that is likely to result in a risk to the rights and freedoms of affected data subjects, as required by NPC Circular 16-03;
• Direct notification to affected Players where the breach is likely to result in a high risk to their rights and freedoms — including notification of the nature of the breach, the categories and approximate number of records affected, the likely consequences, and the measures taken or proposed to address the breach.

Notification to Players will be made through the contact details registered on the affected Accounts (registered email address and/or registered mobile number) and may also be communicated through a notice on the aeowin Platform.

Third-Party Links and External Platforms

The aeowin Platform may contain references to game providers, payment services, or other third-party resources. aeowin's Privacy Policy applies solely to data processed by aeowin in connection with the aeowin Platform. aeowin is not responsible for the privacy practices of any third-party platforms or services.

When you interact with a third-party service — such as completing a GCash or Maya transaction through that provider's own interface — your interaction with that service is governed by the third party's own privacy policy. aeowin encourages you to review the privacy policies of any third-party services you use in connection with your aeowin Account.

Amendments to This Policy

aeowin reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, changes in applicable Philippine law, or changes in regulatory guidance from the National Privacy Commission or PAGCOR.

When material changes are made to this Policy, aeowin will notify registered Players by posting a prominent notice on the Platform and, where practicable, by direct notification to the registered email address or mobile number on the Account. The revised Policy will be effective from the date stated in the update notice.

Continued use of the aeowin Platform following the effective date of any amendment constitutes your acknowledgment of the revised Policy. The current version of this Policy — including its effective date — is always available at aeowin.co/privacy-policy.

Contact Information and Data Protection Officer

For all privacy-related inquiries, data subject rights requests, or concerns about how aeowin handles your personal information, please contact the aeowin Data Protection Officer through the following channels:

• Live Chat: Available 24/7 within the aeowin Platform — the fastest channel for urgent privacy or account security concerns.
• Email: [email protected] (plain text — not a clickable link)

Please mark any data privacy-related correspondence with the subject line "Data Privacy Request" to ensure it is routed directly to the Data Protection Officer. Support agents are aligned to Philippine Standard Time (PST, UTC+8) and are available around the clock, every day of the year.

If you are not satisfied with aeowin's response to a privacy concern or data subject rights request, you have the right to lodge a complaint with the National Privacy Commission of the Philippines. Information on how to file a complaint with the NPC is available on the official NPC website. aeowin will cooperate fully with any NPC investigation arising from a complaint filed by one of its data subjects.